How to share an API key or .env secret safely
At some point a teammate, a contractor or a client needs a key you can't just commit to the repo. The quick fix is to paste it into Slack. This is how to do it without that key living in a chat log forever.
Updated October 2026 · 4 min read
Where shared keys usually leak
- Chat history. Slack, Discord, Teams and WhatsApp keep messages indefinitely by default, and workspace admins or exports can read them.
- Email. Copies sit in sent folders, inboxes and backups, often unencrypted at rest.
- Tickets and pull requests. Issues, comments and CI logs are easy to forget and are sometimes public.
- Screenshots and screen shares. A recorded call with a visible
.env file is a secret stored in a video.
Better options
Use a real secrets store when it's ongoing
If a person will need the key repeatedly, put it where access can be controlled and revoked: a secrets manager, your cloud provider's secret store, or your CI/CD variables. Share access to the store, not the value.
Use a one-time link when it's a handoff
For a one-off, such as giving a contractor a staging key or sending a recovery code, a one-time encrypted link is faster than setting up access. You paste the value, send the link, and it can be read once. After that the copy on the server is deleted, and the chat only holds a dead link.
Scope and rotate
- Create a separate key per person or per purpose, so you can revoke one without breaking everything.
- Give it the minimum permissions that the task needs.
- Rotate the key when the work is done, or when the person leaves.
A simple workflow
- Generate a new key just for this person, with limited scope.
- Paste it into a one-time link tool and set a short expiry.
- For anything sensitive, add an opening password and send that through a different channel (a call or SMS).
- Ask them to confirm they have it, then check that the link now shows as unavailable.
- Rotate the key when the job is finished.
Encoder turns any text into a one-time link. It encrypts in your browser (AES-256-GCM), the key stays in the link's # part and never reaches the server, and the stored data is deleted when the link is opened. No account to open it. Receiving is free, with a few free sends to try, then a one-time $19.99 license.
Open Encoder
Honest limits
- A one-time link is for handing a value over, not for storing it. The recipient still has to put the key somewhere safe.
- Whoever opens the link first gets the value. Don't send it through a channel you don't trust, or add the extra password.
- Encoder is closed-source and not independently audited. If your policy requires an audited or self-hosted tool, use one of those for production credentials.
- Never share production root credentials this way. Use scoped, revocable keys.
Quick answers
Is it okay to put a key in a private repo?
It's better than public, but keys in git history are hard to remove and spread to every clone. Use environment variables or a secrets store instead.
What if I already pasted a key into Slack?
Treat it as exposed. Rotate it, and delete the message if you can, though deleting does not undo copies in exports or backups.